# \[IGN-4521, IGN-4522\] Login "fails" when using Auth0 IDP...but not when you retry **URL:** \ **Category:** Ignition\ **Tags:** ignition80\ **Created:** [May 19, 2021, 10:42pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920 "2021-05-19T22:42:34Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![dpitzer](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@dpitzer](https://forum.inductiveautomation.com/u/dpitzer)\ **Post date:** [May 19, 2021, 10:42pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/1 "2021-05-19T22:42:34Z")
I am using Auth0 as my IDP. Most of the time, when logging in to the Gateway, Designer, or a project, I am successfully redirected to Auth0 where I can successfully log in and am redirected back to Ignition. However, when I’m returned, Ignition does not recognize my authentication so I have to log in a second time, but going back to Auth0, reentering my credentials, and then being redirected back to Ignition…again. The second time, however, works great! Looking through the logs I see several warnings from **org.apache.http.client.protocol.ResponseProcessCookies** stating: ```auto Invalid cookie header: Set-Cookie: did_compat=... Invalid cookie header: Set-Cookie: did=... Invalid 'expires' attribute:... ``` After all those, the **gateway.OIDCWebAuthStrategy** logs a warning of: ```auto Unable to retrieve user info from IDP ``` Searching the web has lead me to think this is an issue with the cookie policy being used by Ignition verses the policy being used by Auth0. Specifically with handling the situation where the cookie has expired. This is why the second time I log in, there is no problem…the cookie I had in my browser the second time was not expired. What are my options for managing cookie policies with my IDP? Or is there something else going on? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 25, 2021, 1:32am UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/3 "2021-09-25T01:32:17Z")
We’ve logged internal tickets to address the “Invalid cookie header” warnings as well as the "Unable to retrieve user info from IDP" error message. The two are completely different issues, and I am not sure if either of them influence the behavior that you mention here: > [@dpitzer](#): > > This is why the second time I log in, there is no problem…the cookie I had in my browser the second time was not expired. This just sounds like how most IdP's manage web browser sessions...the first time you have to login, then a cookie is set on your browser so that subsequent visits within a certain period of time will not require logging in again. The second issue where the user info cannot be parsed is due to Auth0's lack of compliance with the OIDC spec, summarized here: [OIDC ID Token claim updated\_at violates OIDC specification, breaks RP implementations - Auth0 Community](https://community.auth0.com/t/oidc-id-token-claim-updated-at-violates-oidc-specification-breaks-rp-implementations/24098) Specifically, they are returning an `updated_at` value on the user info response JSON as (what appears to be) an [RFC3339](https://datatracker.ietf.org/doc/html/rfc3339) date/time string instead of [what the OIDC spec calls for](https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse), which is a number representing the number of seconds since the well known 1970 epoch. Sounds like you might be able to talk to Auth0 support and have them toggle a setting on your tenant to switch to the compliant version of that value, which will make the error go away on the Ignition side. We are also going to add code to handle this corner case as well, since there are likely many other Auth0 customers using Ignition and they will likely run into the same issue. When setting gateway logger `gateway.HttpOIDCClientService` to level `DEBUG` or `TRACE`, the following additional information should appear, which is what lead me to the above conclusion: ```auto INFO | jvm 1 | 2021/09/24 00:57:04 | D [g.HttpOIDCClientService] [00:57:04]: Unable to deserialize the UserInfo from response entity route-group=federate, idp-adapter-name=Auth0_OIDC, route-path=/callback/:type INFO | jvm 1 | 2021/09/24 00:57:04 | java.lang.NumberFormatException: For input string: "2021-09-22T20:20:31.323Z" INFO | jvm 1 | 2021/09/24 00:57:04 | at java.base/java.lang.NumberFormatException.forInputString(Unknown Source) INFO | jvm 1 | 2021/09/24 00:57:04 | at java.base/java.lang.Long.parseLong(Unknown Source) INFO | jvm 1 | 2021/09/24 00:57:04 | at java.base/java.lang.Long.parseLong(Unknown Source) INFO | jvm 1 | 2021/09/24 00:57:04 | at com.inductiveautomation.ignition.common.gson.JsonPrimitive.getAsLong(JsonPrimitive.java:242) INFO | jvm 1 | 2021/09/24 00:57:04 | at com.inductiveautomation.ignition.gateway.auth.oidc.token.OIDCUserInfo$GsonAdapter.deserialize(OIDCUserInfo.java:416) INFO | jvm 1 | 2021/09/24 00:57:04 | at com.inductiveautomation.ignition.gateway.auth.oidc.token.OIDCUserInfo$GsonAdapter.deserialize(OIDCUserInfo.java:367) ``` ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [October 15, 2021, 12:26am UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/4 "2021-10-15T00:26:14Z")
Tomorrow’s early access build (15 October 2021) should include fixes for these issues. The second issue (“Unable to retrieve user info from IDP”) will be fixed automatically with no configuration changes. The first issue (“Invalid cookie header”) can be fixed by setting a system property in `ignition.conf` - here’s the relevant release note: Exposed a new system property `ignition.http.client.manager.cookieSpec` to control the cookie parsing behavior of the IdP and Perspective HTTP Binding’s Http Client. This new system property may take one of the following values: - `default`: Default cookie specification that picks up the best matching cookie policy based on the format of cookies sent with the HTTP response. - `netscape`: This CookieSpec implementation conforms to the original draft specification published by Netscape Communications. It should be avoided unless absolutely necessary for compatibility with legacy applications. - `standard`: Standard CookieSpec implementation that enforces a more relaxed interpretation of the HTTP state management specification (RFC 6265, section 5) for interoperability with existing servers that do not conform to the well behaved profile (RFC 6265, section 4). - `standard-strict`: Standard CookieSpec implementation that enforces syntax and semantics of the well-behaved profile of the HTTP state management specification (RFC 6265, section 4). If the system prop is undefined or does not match any of the supported values, default value should be `default`, which is the spec that was used by default in Ignition versions before this system property was exposed. For Auth0: `standard` or `standard-strict` should solve the problem. ---
**Author:** ![Simen](https://avatars.discourse-cdn.com/v4/letter/s/7cd45c/32.png) [@Simen](https://forum.inductiveautomation.com/u/Simen)\ **Post date:** [June 18, 2024, 12:07pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/5 "2024-06-18T12:07:56Z")
I get the same cookie header warning, with invalid expires attribute. > Invalid cookie header: "Set-Cookie: did\_compat=s%3Av0%3Ad772de16........; Max-Age=31557600; Path=/; Expires=Wed, 18 Jun 2025 16:47:13 GMT; HttpOnly; Secure". Invalid 'expires' attribute: Wed, 18 Jun 2025 16:47:13 GMT But setting `ignition.http.client.manager.cookieSpec` to standard or standard-strict doesnt seem to make any change. Dont experience any problems, but i dont like seeing the warning in the log, i guess it affects something. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 18, 2024, 12:21pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/6 "2024-06-18T12:21:16Z")
Clock issues? ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [June 18, 2024, 1:00pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/7 "2024-06-18T13:00:07Z")
As @pturmel pointed out it could be clock, or are you still running an older version that doesn't have the patch/fix for the `ignition.http.client.manager.cookieSpec` in it yet. ---
**Author:** ![Simen](https://avatars.discourse-cdn.com/v4/letter/s/7cd45c/32.png) [@Simen](https://forum.inductiveautomation.com/u/Simen)\ **Post date:** [June 18, 2024, 1:06pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/8 "2024-06-18T13:06:32Z")
Checked the time of the server, its within 1sec of local time. We are running 8.1.36, so it should have the patch. Im not quite sure what ignition expects, is the "Wed, 18 Jun 2025 16:47:13 GMT" format from the log wrong? Did a test login on the gateway, and this is the result with everything that included time. Guess its the updated\_at value that is the issue. idTokenClaims: `"updated_at": "2024-06-18T12:55:53.321Z",` `"iat": 1718715354,` `"exp": 1718751354,` tokenEndpointResponse: `"expires_in": 86400,` userInfo: `"updated_at": 1718715353,` ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [June 18, 2024, 1:37pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/9 "2024-06-18T13:37:41Z")
Is your time zone set up correctly also? If your time is set in GMT to local time, you'll be off by however many hours the offset is. Best is if you have an NTP server of any kind to sync time with it (or if internet connected let Windows do it's time sync or if Linux set up `chrony`. ---
**Author:** ![Simen](https://avatars.discourse-cdn.com/v4/letter/s/7cd45c/32.png) [@Simen](https://forum.inductiveautomation.com/u/Simen)\ **Post date:** [June 18, 2024, 1:50pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/10 "2024-06-18T13:50:48Z")
The timezone is set correct, +1. And the time is synched with [time.windows.com](http://time.windows.com), so i dont think its a problem there. ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [June 18, 2024, 3:01pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/11 "2024-06-18T15:01:20Z")
I would reach out to support then to let them look at it to see what could be causing that error. ---
**Author:** ![Simen](https://avatars.discourse-cdn.com/v4/letter/s/7cd45c/32.png) [@Simen](https://forum.inductiveautomation.com/u/Simen)\ **Post date:** [December 9, 2024, 1:27pm UTC](https://forum.inductiveautomation.com/t/ign-4521-ign-4522-login-fails-when-using-auth0-idp-but-not-when-you-retry/46920/12 "2024-12-09T13:27:12Z")
For anyone searching up this thread in the future. My issue was, in the config file, you cant simply enter: ```python ignition.http.client.manager.cookieSpec=standard ``` You need to enter: ```python wrapper.java.additional.10=-Dignition.http.client.manager.cookieSpec=standard ``` Where 10 is a unique number in your wrapper.java.additional.X parameters section. Auth0 also enabled oidc\_conformant\_updated\_at flag, but this alone did not mitigate the issue, so i guess there was something else that was not fully OIDC compliant.